Halloween DealsAmazon USHalloween week deals: useful picks before month-endAmazon US: current deals, useful picks and tech finds.Check DealsWindows FixRecommendedWindows errors stealing your time? Find the fix fastScan stability, cleanup and performance issues.Fix NowHalloween DealsAmazon USOctober picks are moving - compare before checkoutAmazon US: current deals, useful picks and tech finds.See Picks×
Skip to content
World desk10 min

How to SSH Into a VPS Using a Domain Name Instead of an IP

A practical guide to pointing a domain or subdomain at a VPS and connecting securely with OpenSSH instead of memorizing an IP address.
Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

Yes. Point a DNS hostname at your VPS public address, wait until the name resolves, then connect with ssh [email protected]. If the server uses a private key or a non-default port, add -i and -p, for example ssh -i ~/.ssh/id_ed25519 -p 2222 [email protected]. The domain replaces only the address lookup; the VPS still needs a reachable SSH service, an allowed port, and valid credentials.

How the domain-based connection works

SSH does not connect to a domain as a separate transport. Your SSH client first asks DNS for the network address behind the hostname. It then opens an SSH connection to that address, normally on TCP port 22 unless you specify another port.

As an Amazon Associate I earn from qualifying purchases.

Free tools Windows power users keep installed

One-click scans. No signup required.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

For example, ssh.example.com can resolve to 203.0.113.10. The command ssh [email protected] therefore reaches the same VPS that you could reach with ssh [email protected]. A hostname is easier to remember and can continue to point to the server if its public address changes, but it does not provide authentication or encryption by itself. SSH encryption and host-key verification still protect the session.

Information to collect before changing DNS

Have these values ready from your VPS provider or server administrator:

#1 Best Overall
Sale
TOZO A1 Wireless Earbuds Bluetooth 5.3 Light Weight in Ear Headphones | IPX5 Waterproof,2 Mics for AI Calls,Immersive Premium Sound Bass Headset with Charging Case,32 EQ via App Black
  • [Ultra-Lightweight Ear Buds Designed for Small Ears] Each earbud weighs only 3.7g and features a compact, ergonomic in-ear design made especially for small ears. Secure, low-profile, and comfortable for workouts, all-day wear or overnight sleeping.The ultra-slim profile sits flush in your ear with no hard edges poking or rubbing, so you can even sleep on your side without discomfort.
  • [Immersive Stereo Sound with TOZO OrigX Technology] TOZO OrigX tuning delivers clear vocals, balanced mids, and natural stereo sound for music, podcasts, and videos.
  • [Long Battery Life for Daily Use] Get up to 7 hours of playtime on a single charge, with up to 32 hours total using the charging case—ideal for workdays, commuting, and extended listening sessions.
  • [Bluetooth 5.3 & Stable Connection] Bluetooth 5.3 provides fast pairing, stable wireless performance, and reduced dropouts as you move around home or office.
  • [Deep Bass with Clear Vocals] High-performance drivers produce punchy bass while keeping vocals clean and detailed for everyday listening.
Item What to record Why it matters
Public IPv4 address The VPS address reachable from the internet Used in the DNS A record and as an emergency direct-connect address
Public IPv6 address Only if the VPS has working IPv6 connectivity Used in an AAAA record; an unreachable IPv6 record can cause failed or delayed connections
SSH username The account permitted to log in The username is part of the SSH command and must match the server configuration
Authentication method Private-key path, password, or both Determines whether you need -i, a passphrase, or a password
SSH port Usually 22, or the custom port configured in sshd The DNS record does not specify a port; a custom port must be supplied separately

Provider documentation commonly lists the IP address, username, and authentication method as the basic connection information. Do not assume that the account name used by one VPS image works on another; use the account supplied for this instance.

Choose a hostname for SSH

Use a name in a DNS zone that you control. A dedicated subdomain such as ssh.example.com is usually clearer than reusing the website’s apex name. It separates the administrative endpoint from web traffic and lets you move the website and server independently.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

The label is your choice: ssh.example.com, vps.example.com, or another descriptive name all work. The complete hostname must be spelled exactly the same in the DNS record, diagnostic commands, SSH command, and any local SSH configuration.

Create the DNS record

Add an A record for IPv4

  1. Open the DNS management panel for the zone containing your domain.
  2. Create a record with type A.
  3. Enter the host or name field as ssh if the panel appends .example.com automatically. Otherwise enter the full hostname ssh.example.com.
  4. Set the value to the VPS public IPv4 address.
  5. Leave the record un proxied if your DNS provider offers a web-proxy toggle that is not intended for arbitrary SSH traffic. A plain DNS answer must return the VPS address directly.
  6. Save the record and note the TTL shown by the provider. Resolvers can cache the old answer until that TTL expires.

Do not put a port number in an A record. A value such as 203.0.113.10:2222 is not a valid IPv4 address for this purpose.

Add an AAAA record only for usable IPv6

If the VPS has a publicly reachable IPv6 address and the client network supports IPv6, add a separate AAAA record for the same hostname. The value must be the IPv6 address, not an IPv4 address. Do not add an AAAA record merely because the provider displays an IPv6 address: the server firewall, routing, SSH listener, and client network must all support it.

An incorrect or unreachable AAAA record can make a hostname appear broken even when its A record is correct, because some clients try IPv6 first. Remove or correct the AAAA record if IPv6 is not actually available.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

Wait for DNS and verify the name locally

DNS changes are cached by recursive resolvers. There is no universal propagation time: visibility depends on the record’s previous TTL, resolver caches, and the DNS provider’s update process. Test the name from the same network and device that will run SSH instead of assuming that a successful lookup from the DNS dashboard means every resolver has updated.

Rank #2
Sale
Smart Watch for Men Women Compatible with iPhone Samsung Android Phone 1.69 inch Full Touch Screen IP68 Waterproof Bluetooh Fitness Tracker Heart Rate/Sleep Monitor (Black)
  • 【IP68 Waterproof Multifunctinal Smart Watch】Torjalph fitness activity tracker smart watch is IP68 waterproof technology ,you can wear it when swimming,handwashing,it's rain-proof which means that you perform multiple exercise modes outside without worrying about sweat or rain corroding your fitness smart watch,and this watch equipped with a 230 mAh large capacity battery magnetic charging ,and this sports activity tracker watch can be used 5-7 days If fully charged.
  • 【Larger 1.83'' Full Screen Watch & Multi-dial Selection】1.83 inch full HD color touch screen smart watch for men / women provides excellent 240*284 resolution image quality ,This Bluetooth smart watch offers a better touch experience and remarkable immersion and ,more than 200 watch faces for you to choose from App"Da Fit ", you can change the dial style according to your mood to wear keeping the world on your wrist
  • 【Accurate Activity Tracker Smart Watch 】sports watch activity tracker uses sweat and dust resistant breathable silicone strap, our Fitness Tracker Smart Watch for Android iOS Phones supports 12 sports modes,walking,running,bicycle,swimming,badminton,basketball,football,rope skipping. This bluetooth calls smart watch for men women is lightweight and stylish, bringing more convenient and relaxing sports experience while also providing more protection.
  • 【Your 24 Hour Personal Daily Health Monitor】Fitness watch for women men full touch screen IP67 waterproof bluetooth smartwatch for Android iOS Phones with heart rate blood pressure monitor multifunction Andriod smart watch with steps counter sleep monitor sports fitness watch, monitoring blood oxygen saturation allows you to understand your physical condition in real time to track fitness progress ,to know your health status in time.
  • 【More Functions Bluetooth Call Smart Watch】This fitness activity smart watch full screen for iPhone and Android phones includes a bunch of new features including:The bluetooth smart watch can hang up the phone, receive and display WhatsAPP /Text /Facebook /Twitter /Messenger reminder.Support sedentary reminder, alarm clock, stopwatch, timer,weather information,music control, remote camera control compatible with Android 5.0 and above or iOS 9.0 and above smartphones.

Check with dig

On Linux, macOS, or another system with BIND utilities, run:

dig +short ssh.example.com

An IPv4 result should show the VPS address. To request only IPv4 or IPv6 answers, use:

dig A +short ssh.example.com
dig AAAA +short ssh.example.com

An empty result means that the queried resolver did not return that record. A different address means the record is not yet updated, is being overridden by another record, or was entered in the wrong DNS zone.

What’s actually slowing this PC down?

Pick the symptom - the matching free tool is one click away.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

Check with nslookup or getent

If dig is unavailable, use:

nslookup ssh.example.com

On many Linux systems, getent hosts ssh.example.com shows the addresses returned through the system resolver. Compare the output with the VPS address you recorded. Check spelling carefully; a missing label, extra dot, or wrong domain is enough to produce a hostname-resolution error.

Test the address without SSH

Once DNS returns an address, test whether the selected TCP port is reachable:

nc -vz ssh.example.com 22

Replace 22 with the configured port. A successful DNS lookup and a failed port test are different problems: the name can be correct while a firewall or stopped service blocks the connection.

Connect with OpenSSH

Default port and an account using the default key location

Run:

ssh [email protected]

OpenSSH looks for keys in its normal locations, including ~/.ssh/id_ed25519 and other configured identities. If the correct key is there and the server accepts it, SSH asks for the key’s passphrase, not the VPS account password.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.
Rank #3
New Bee Guitar Cable 10ft Electric Instrument Bass AMP Cord
  • [Low Noise High Fidelity] New bee guitar cord with 22AWG oxygen-free-copper center conductors provides enhanced signal transfer, the PVC insulation material and the high-density stranded copper double shield provide noise rejection for quiet operation
  • [Ideal for Choice] New bee 1/4 straight and right angle metal connectors, ensures a secure connection in any instrument, pedal, or amp jack. L shape great fro on stage guitar stands
  • [Wide Compatible] Suitable for mixer, power amplifier, microphone, effector, decoder, equalizer, electoronic organ, electric guitar, electric bass and other electronic equipments. Widely used in the installation of smart home, karaoke speaker, professional stage audio, etc
  • [Easy Disassemble] Making incidental repairs quick and easy! Very nice, flexible cable
  • [Dont Hesite to Order] 24 hours customer services and professional technology team are standing by

Specify a private key explicitly

Use -i when the key is stored elsewhere or you want to select one identity deliberately:

ssh -i ~/.ssh/id_ed25519 [email protected]

Protect the private key from other local users. On Unix-like systems, a key that is broadly readable may be rejected by OpenSSH; restrict it with:

chmod 600 ~/.ssh/id_ed25519

Use the actual path and filename for your key. Never copy a private key into DNS settings or send it to a server administrator through an untrusted channel.

Use a custom SSH port

If sshd listens on port 2222 instead of port 22, the command is:

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.
ssh -p 2222 [email protected]

With an explicit key and port:

ssh -i ~/.ssh/id_ed25519 -p 2222 [email protected]

Changing the port does not replace key-based authentication, firewall rules, account controls, or updates. The provider firewall and the operating-system firewall must both allow the selected port.

Save the settings in SSH config

For regular use, put the connection details in ~/.ssh/config:

Host my-vps
    HostName ssh.example.com
    User username
    Port 2222
    IdentityFile ~/.ssh/id_ed25519

After saving the file, connect with:

ssh my-vps

Keep the file private and verify its indentation if OpenSSH reports a configuration error. The HostName is the DNS name; Port remains a separate setting because DNS does not carry port information.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.
Rank #4
BSIMB 15.6" Digital Family Calendar & Chore Chart, No Subscription Fees
  • Digital Family Calendar: BSIMB digital calendar wall touch screen puts an end to your chaotic life. Designed for busy families, the digital calendar keeps you organised and in step with your family. Assign different colours and tasks to each family member to make family scheduling easier and more intuitive.
  • Easy Setup and Auto-Sync: Plug in, connect to WLAN and auto-syn your electric calendar in minutes. Digital wall calendar compatible with Google calendar, iCloud calendar, Outlook calendar, Cozi calendar and Yahoo calendar. Add events directly on the device or through the ecalendar app. Electronic calendar stays current whether you're at work or traveling—no manual updates needed.
  • All-In-One Home Assistant: Smart calendar builds habits and encourage independence with personalised chores. Display daily meal plan to reduce the daily ‘What's for dinner?’ stress. To-do lists keep track of everything you want. Turning chores into valuable achievements with stars and rewards, making life easier and more enjoyable.
  • Manage Anytime Anywhere: BSIMB electronic calendar for family stay connected with the powerful ecalendar app. Access and manage your digital wall calendar anytime, anywhere with free features like stars & rewards, photo screensaver, chore charts, meals plans, to-do lists etc. Electronic planner paid features like Magic Import tailor advanced tools for users with special needs.
  • Stay in Touch with Loved Ones: Share photos or videos from your phone to electronic wall calendar with app, instantly update your life moment, and keep in touch with your family, especially those who are far away; you can also surprise your smart calendar digital wall by sending him a wish card; it's also great for keeping tech-illiterate elders in touch with the youngsters.

Verify the host key on the first connection

On the first connection, OpenSSH normally reports that the server is not yet identified on your local machine and asks whether to continue. Before accepting, compare the fingerprint shown in the prompt with a fingerprint obtained through a trusted channel, such as the VPS provider’s console or a console session you already trust.

Accepting the key saves it in your local known_hosts file. Later connections compare the server’s presented key with that saved value. A changed-key warning must not be dismissed automatically. It can occur after a legitimate rebuild when a reused address receives a new server key, but it can also indicate that traffic is being intercepted.

If you have confirmed that the VPS was rebuilt and that the new fingerprint is correct, remove the old entry with:

ssh-keygen -R ssh.example.com

Connect again and verify the newly displayed fingerprint before accepting it. If you cannot explain the change, stop and investigate through the provider console or administrator rather than deleting the warning.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

Authenticate and end the session

After the host-key check, SSH authenticates the account. Enter the private-key passphrase or account password requested by the server. A successful login normally presents the remote shell prompt.

When finished, close the session cleanly:

exit

If the connection drops unexpectedly, reconnect using the same hostname and port. The domain name remains a lookup alias; it does not preserve a session or change the server’s account permissions.

Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Support on Ko-Fi

Troubleshoot the common errors

Could not resolve hostname

An error such as ssh: Could not resolve hostname ssh.example.com: Name or service not known means the client could not map the name to an address. It occurs before SSH authentication.

  • Check every character of the hostname and the command’s spelling.
  • Run dig +short ssh.example.com or nslookup ssh.example.com from the affected client.
  • Confirm that the A or AAAA record exists in the authoritative DNS zone for the domain.
  • Check whether the record was entered under the provider’s expected host format; some panels want ssh, while others want the full name.
  • Wait for cached answers to expire and test with another resolver if appropriate.
  • Use the VPS IP temporarily if you must connect before DNS is corrected.

DNS resolves, but the connection times out

A timeout usually means the address was found but no response returned from the selected port. Check that:

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.
  • The VPS is powered on and has a working public route.
  • The port in the SSH command matches the port configured in sshd.
  • The VPS provider’s network firewall allows inbound TCP traffic on that port.
  • The operating-system firewall allows the port and does not restrict your client address.
  • Your current network permits outbound SSH traffic.
  • An IPv6 answer is not sending the client toward an unreachable IPv6 path.

Test the port with nc -vz ssh.example.com 2222, replacing the example port. If the direct IP also times out, DNS is not the primary problem.

Connection refused

Refusal means the address was reachable but no service accepted the selected port. On the VPS console, check whether the SSH daemon is running and listening, and confirm the configured port. If the daemon listens on 2222 while the command uses the default 22, use -p 2222 or correct the server configuration. A firewall that actively rejects a port can also produce refusal.

Permission denied

The network path worked, but authentication failed. Verify:

  • The username is the account created by the VPS image or administrator.
  • The -i path points to the matching private key.
  • The private key permissions are restrictive enough for OpenSSH to use it.
  • The corresponding public key is present in the account’s authorized_keys file.
  • Password authentication is enabled only if you intentionally rely on it and the password is correct.
  • You are not accidentally offering a key for a different server or account.

Use verbose mode to see which stage fails without exposing private-key contents:

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.
ssh -v -i ~/.ssh/id_ed25519 [email protected]

Do not paste private keys or passphrases into support tickets or terminal screenshots.

Host key changed warning

Stop at the warning and verify the server identity. Rebuilding a VPS can legitimately replace its host key, especially when an address is reused, but an unexpected change has the same warning because SSH cannot distinguish a rebuild from interception. Confirm the new fingerprint through a trusted console before using ssh-keygen -R.

Choose between the main connection options

Option Use it when Important difference
A record The VPS is reachable over IPv4 Maps the hostname to an IPv4 address
AAAA record The VPS and client both have working IPv6 Maps the hostname to IPv6; do not publish an unreachable address
Port 22 The server retains the standard SSH listener Works with the simplest command and common tooling
Custom port The administrator configured SSH elsewhere Requires -p or a Port entry in SSH config and matching firewall rules
Password authentication Keys are unavailable or a provider requires an initial password login Convenient, but exposed passwords can be guessed; follow the server’s password policy
SSH key authentication You control a private key and can install its public key Supports passphrases and avoids sending an account password during login
Direct public VPS The VPS can safely accept SSH from your client network One public endpoint to protect with firewall and authentication controls
Private VPS through a bastion The target has no public SSH endpoint Requires a reachable jump host and an additional SSH hop, commonly configured with ProxyJump

Security practices that remain necessary

  • Prefer key-based authentication where the server supports it, and protect the private key with a strong passphrase.
  • Verify the host fingerprint through a trusted channel on first connection and after any rebuild or key-change warning.
  • Restrict inbound SSH at both the provider firewall and the VPS firewall where practical.
  • Use a dedicated administrative hostname rather than assuming a website name identifies the correct server.
  • Keep the SSH daemon and operating system updated according to the server administrator’s maintenance process.
  • Do not treat a domain as an authentication control. Anyone who can alter the DNS record can redirect the name to another address; host-key verification is what reveals an unexpected server.
  • Keep a direct IP or provider-console recovery path documented in case DNS fails.

A repeatable checklist

  1. Record the VPS public IPv4 address, usable IPv6 address if applicable, username, authentication method, and SSH port.
  2. Create ssh.example.com or another hostname in a DNS zone you control.
  3. Add an A record for IPv4 and add AAAA only when IPv6 is genuinely reachable.
  4. Query the name with dig, nslookup, or getent from the client.
  5. Run ssh [email protected], adding -i for a non-default key and -p for a custom port.
  6. Compare the first-connection fingerprint with a trusted provider or console record.
  7. Authenticate, confirm the expected remote account, and end the session with exit.
  8. If it fails, classify the error as DNS resolution, network timeout, refused port, authentication failure, or host-key mismatch before changing settings.

Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.

Leave a Reply

Your email address will not be published. Required fields are marked *

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

More from the Wire

  1. World desk4 min
    How to Spot an AI Voice Scam Before Sending MoneyDon’t rely on how a caller sounds. Pause, call back through a known number, and verify the emergency with another trusted person before sending money.
  2. Mountain View desk4 min
    Google’s SynthID Detector: How to Check AI-Generated Images, Video and AudioGoogle’s SynthID Detector looks for an embedded watermark in supported images, video and audio. Here is what its results do—and do not—show.
  3. Redmond desk20 min
    How to create a link to File or Folder in Windows 11Windows 11 gives you several ways to point to a file or folder without moving or duplicating it. You can create a desktop shortcut,…
Recommended PC Tool
Recommended PC Tool
PC Slower Than It Used to Be?Free scan - under a minute
Outdated Drivers Are Slowing You DownFree scan - exact matches

Two free Windows tools

One Free Minute Could Fix That PC

Before you go - each of these free tools takes about a minute and tackles what quietly slows a Windows PC down.

Special offer. View Outbyte info, uninstall instructions, EULA, and Privacy Policy.